Extracted

Extracted

• • Target

    a7f52eedcc6151651cc7abeedf4c65148f9965046cf5dcc26f3d79b850685ab9

  • Size

    908KB

  • MD5

    aeb426f4d51b50fdc53018c226d718fc

  • SHA1

    cd53ecac0e27001286f1dcef6fe0ea8271541320

  • SHA256

    a7f52eedcc6151651cc7abeedf4c65148f9965046cf5dcc26f3d79b850685ab9

  • SHA512

    a4c12a5f957a6ab12cfad3ffdbf41fa9afdf4dd99825023047d7bf86d5d298276940a793cb28c652af204c0c17b9ac56629bb0922bf96752d49e4513ed8f2935

  • SSDEEP

    12288:aMrNy90YSODPUByVELNwxdB5usH2nKn1pulKcXT2jf92jv4/9Qf3x/x14OD:Xy/SGMB9e7ubno9Wij0vwQfZx9D

  Score

  10^/10

  redlinedownpolodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1